Run the Aider build pod under an OpenShell sandbox (self-hosted LLM egress)

[dev-dull]

Part of #103. Depends on the Aider epic #99 (final implementation) and on the Claude-wrapping + feasibility tickets.

Run the Aider build pod inside an OpenShell sandbox, with a policy that allowlists the operator's self-hosted LLM endpoint. This is where sandboxing meets the sovereignty goal: code and inference stay in-house, and the LLM credential never enters the agent process (OpenShell Privacy Router).

⚠️ Check how Aider was actually implemented first

Aider is not on OpenShell's official supported-agent list, and its integration details are decided in #99 → #100 / #101 / #102, not here. Before writing any policy or launch wiring, read the merged Aider implementation and confirm the real contract:

• The env-var / endpoint contract (OPENAI_API_BASE / OPENAI_API_KEY / OLLAMA_API_BASE) — the egress allowlist and Privacy Router config depend on the exact host(s) Aider dials.
• Launch invocation (--yes-always, --message seed mapping) and whether it runs under ttyd like Claude.
• Aider's git auto-commit behavior vs SUS autosave (whatever Add Aider as a build-pod assistant backend #101 decided) — make sure the sandbox's filesystem policy (include_workdir / read-write paths) doesn't break it.
• The guidance file (CONVENTIONS.md) location, so filesystem policy allows it.

Scope (once the above is known)

1. Spike: confirm Aider runs unmodified under the OpenShell sandbox (generic-process path) in a build pod.
2. Confirm inference works: egress allowlist / Privacy Router correctly routes Aider's OpenAI-compatible calls to the self-hosted endpoint and blocks everything else.
3. Ship an Aider policy tier (or extend the tiers ticket) whose egress allowlist targets the local LLM endpoint instead of the Anthropic API.

Acceptance

• An Aider build session runs against a self-hosted OpenAI-compatible endpoint entirely inside the sandbox; a call to any non-allowlisted host is blocked; the LLM credential is not present in the agent's environment.